theory Enrich

imports Main Flask Static Init_prop Valid_prop Tainted_prop Delete_prop Co2sobj_prop S2ss_prop S2ss_prop2

 Temp

begin

(* enriched objects, closely related to static objects, so are only 3 kinds *)

datatype t_enrich_obj = 

  E_proc "t_process" "t_msgq" "t_msgq"

| E_file "t_file" "nat" 

| E_msgq "t_msgq"

(* objects that need dynamic indexing, all nature-numbers *)

datatype t_index_obj = 

  I_proc "t_process" 

| I_file "t_file"

| I_fd   "t_process" "t_fd"

| I_inum "nat"

| I_msgq "t_msgq"

| I_msg  "t_msgq"    "t_msg"

context tainting_s begin

fun no_del_event:: "t_event list \<Rightarrow> bool"

where

  "no_del_event [] = True"

| "no_del_event (Kill p p' # \<tau>)  = False"

| "no_del_event (Exit p # s) = False"

| "no_del_event (CloseFd p fd # \<tau>) = False"

| "no_del_event (UnLink p f # \<tau>) = False"

| "no_del_event (Rmdir p f # \<tau>)  = False"

(*

| "no_del_event (Rename p f f' # \<tau>)  = False"

*)

| "no_del_event (RemoveMsgq p q # \<tau>) = False"

(*

| "no_del_event (RecvMsg p q m # \<tau>)  = False"

*)

| "no_del_event (_ # \<tau>) = no_del_event \<tau>"

(*

fun all_inums :: "t_state \<Rightarrow> t_inode_num set"

where

  "all_inums [] = current_inode_nums []"

| "all_inums (Open p f flags fd opt # s) = (

    case opt of

      None \<Rightarrow> all_inums s

    | Some i \<Rightarrow> all_inums s \<union> {i} )"

| "all_inums (Mkdir p f i # s) = (all_inums s \<union> {i})"

| "all_inums (CreateSock p af st fd i # s) = (all_inums s \<union> {i})"

| "all_inums (Accept p fd addr lport fd' i # s) = (all_inums s \<union> {i})"

| "all_inums (_ # s) = all_inums s"

fun all_fds :: "t_state \<Rightarrow> t_process \<Rightarrow> t_fd set"

where

  "all_fds [] = init_fds_of_proc"

| "all_fds (Open p f flags fd ipt # s) = (all_fds s) (p := all_fds s p \<union> {fd})"

| "all_fds (CreateSock p sf st fd i # s) = (all_fds s) (p := all_fds s p \<union> {fd})"

| "all_fds (Accept p fd' raddr port fd i # s) = (all_fds s) (p := all_fds s p \<union> {fd})"

| "all_fds (Clone p p' fds # s) = (all_fds s) (p' := fds)"

| "all_fds (_ # s) = all_fds s"

fun all_msgqs:: "t_state \<Rightarrow> t_msgq set"

where

  "all_msgqs [] = {}"

| "all_msgqs (CreateMsgq p q # s) = all_msgqs s \<union> {q}"

| "all_msgqs (e # s) = all_msgqs s"

*)

fun all_msgs:: "t_state \<Rightarrow> t_msgq \<Rightarrow> t_msg set"

where

  "all_msgs [] q = {}"

| "all_msgs (CreateMsgq p q # s) q' = (if q' = q then {} else all_msgs s q')"

| "all_msgs (SendMsg p q m # s) q' = (if q' = q then all_msgs s q \<union> {m} else all_msgs s q')"

| "all_msgs (_ # s) q' = all_msgs s q'"

fun all_files:: "t_state \<Rightarrow> t_file set"

where

  "all_files [] = init_files "

| "all_files (Open p f flags fd opt # s) = (if opt = None then all_files s else (all_files s \<union> {f}))"

| "all_files (Mkdir p f inum # s) = all_files s \<union> {f}"

| "all_files (LinkHard p f f' # s) = all_files s \<union> {f'}"

| "all_files (e # s) = all_files s"

(*

fun notin_all:: "t_state \<Rightarrow> t_enrich_obj \<Rightarrow> bool"

where

  "notin_all s (E_proc p)  = (p \<notin> all_procs s)"

| "notin_all s (E_file f)  = (f \<notin> all_files s \<and> (\<exists> pf. parent f = Some pf \<and> is_dir s pf))"

| "notin_all s (E_fd p fd) = (fd \<notin> all_fds s p)"

| "notin_all s (E_inum i)  = (i \<notin> all_inums s)"

| "notin_all s (E_msgq q)  = (q \<notin> all_msgqs s)"

| "notin_all s (E_msg q m) = (m \<notin> all_msgs s q)"

*)

fun nums_of_recvmsg:: "t_state \<Rightarrow> t_process \<Rightarrow> nat"

where

  "nums_of_recvmsg [] p' = 0"

| "nums_of_recvmsg (RecvMsg p q m # s) p' = 

     (if p' = p then Suc (nums_of_recvmsg s p) else nums_of_recvmsg s p')"

| "nums_of_recvmsg (e # s) p' = nums_of_recvmsg s p'"

lemma nums_of_recv_0:

  "\<lbrakk>p \<notin> current_procs s; no_del_event s; valid s\<rbrakk> \<Longrightarrow> nums_of_recvmsg s p = 0"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply (auto)

done

lemma new_msgq_1:

  "\<lbrakk>new_msgq s \<le> q; q \<le> new_msgq s - Suc 0\<rbrakk> \<Longrightarrow> False"

apply (subgoal_tac "new_msgq s \<noteq> 0")

apply (simp, simp add:new_msgq_def next_nat_def)

done

fun notin_cur:: "t_state \<Rightarrow> t_enrich_obj \<Rightarrow> bool"

where

  "notin_cur s (E_proc p qmin qmax)  = 

    (p \<notin> current_procs s \<and> qmin = new_msgq s \<and> qmax = new_msgq s + (nums_of_recvmsg s p) - 1)"

| "notin_cur s (E_file f inum)  = 

    (f \<notin> current_files s \<and> (\<exists> pf. parent f = Some pf \<and> is_dir s pf) \<and> inum \<notin> current_inode_nums s)"

| "notin_cur s (E_file_link f)  = 

    (f \<notin> current_files s \<and> (\<exists> pf. parent f = Some pf \<and> is_dir s pf))"

| "notin_cur s (E_msgq q)  = (q \<notin> current_msgqs s)"

(*

lemma not_all_procs_cons:

  "p \<notin> all_procs (e # s) \<Longrightarrow> p \<notin> all_procs s"

by (case_tac e, auto)

lemma not_all_procs_prop:

  "\<lbrakk>p' \<notin> all_procs s; p \<in> current_procs s; valid s\<rbrakk> \<Longrightarrow> p' \<noteq> p"

apply (induct s, rule notI, simp)

apply (frule vt_grant_os, frule vd_cons, frule not_all_procs_cons, simp, rule notI)

apply (case_tac a, auto)

done

lemma not_all_procs_prop2:

  "p' \<notin> all_procs s \<Longrightarrow> p' \<notin> init_procs"

apply (induct s, simp)

by (case_tac a, auto)

lemma not_all_procs_prop3:

  "p' \<notin> all_procs s \<Longrightarrow> p' \<notin> current_procs s"

apply (induct s, simp)

by (case_tac a, auto)

*)

(*

lemma not_all_msgqs_cons:

  "p \<notin> all_msgqs (e # s) \<Longrightarrow> p \<notin> all_msgqs s"

apply (case_tac e, auto)

lemma not_all_msgqs_prop:

  "\<lbrakk>p' \<notin> all_msgqs s; p \<in> current_msgqs s; valid s\<rbrakk> \<Longrightarrow> p' \<noteq> p"

apply (induct s, rule notI, simp)

apply (frule vt_grant_os, frule vd_cons, frule not_all_msgqs_cons, simp, rule notI)

apply (case_tac a, auto)

done

lemma not_all_msgqs_prop3:

  "p' \<notin> all_msgqs s \<Longrightarrow> p' \<notin> current_msgqs s"

apply (induct s, simp)

by (case_tac a, auto)

  *)

fun enrich_not_alive :: "t_state \<Rightarrow> t_enrich_obj \<Rightarrow> t_index_obj \<Rightarrow> bool"

where

  "enrich_not_alive s obj (I_file f)  = 

  (f \<notin> current_files s \<and> (\<forall> inum. obj \<noteq> E_file f inum) \<and> obj \<noteq> E_file_link f)"

| "enrich_not_alive s obj (I_proc p)  = (p \<notin> current_procs s \<and> (\<forall> qmin qmax. obj \<noteq> E_proc p qmin qmax))"

| "enrich_not_alive s obj (I_fd p fd) = 

  ((p \<in> current_procs s \<longrightarrow> fd \<notin> current_proc_fds s p) \<and> (\<forall> qmin qmax. obj \<noteq> E_proc p qmin qmax))"

| "enrich_not_alive s obj (I_msgq q)  = (q \<notin> current_msgqs s \<and> obj \<noteq> E_msgq q \<and> 

     (case obj of

        E_proc p qmin qmax \<Rightarrow> \<not> (q \<ge> qmin \<and> q \<le> qmax)

      | _        \<Rightarrow> True) )"

| "enrich_not_alive s obj (I_inum i)  = (i \<notin> current_inode_nums s \<and> (\<forall> f. obj \<noteq> E_file f i))"

| "enrich_not_alive s obj (I_msg q m) = 

  ((q \<in> current_msgqs s \<longrightarrow> m \<notin> set (msgs_of_queue s q)) \<and> obj \<noteq> E_msgq q \<and>

     (case obj of

        E_proc p qmin qmax \<Rightarrow> \<not> (q \<ge> qmin \<and> q \<le> qmax)

      | _        \<Rightarrow> True) )"

lemma file_has_parent: "\<lbrakk>is_file s f; valid s\<rbrakk> \<Longrightarrow> \<exists> pf. is_dir s pf \<and> parent f = Some pf"

apply (case_tac f)

apply (simp, drule root_is_dir', simp+)

apply (simp add:parentf_is_dir_prop2)

done

lemma enrich_search_check:

  assumes grant: "search_check s (up, rp, tp) f"

  and cf2sf: "\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile s' f = cf2sfile s f"

  and vd: "valid s" and f_in: "is_file s f"  and f_in': "is_file s' f"

  and sec: "sectxt_of_obj s' (O_file f) = sectxt_of_obj s (O_file f)"

  shows "search_check s' (up, rp, tp) f"

proof (cases f)

  case Nil

  with f_in vd have "False" 

    by (auto dest:root_is_dir') 

  thus ?thesis by simp

next

  case (Cons n pf)

  from vd f_in obtain sf where sf: "cf2sfile s f = Some sf"

    apply (drule_tac is_file_in_current, drule_tac current_file_has_sfile, simp)

    apply (erule exE, simp)

    done

  then obtain psfs where psfs: "get_parentfs_ctxts s pf = Some psfs" using Cons

    by (auto simp:cf2sfile_def split:option.splits if_splits)

  from sf cf2sf f_in have sf': "cf2sfile s' f = Some sf" by (auto dest:is_file_in_current)

  then obtain psfs' where psfs': "get_parentfs_ctxts s' pf = Some psfs'"using Cons

    by (auto simp:cf2sfile_def split:option.splits if_splits)

  with sf sf' psfs have psfs_eq: "set psfs' = set psfs" using Cons f_in f_in'

    apply (simp add:cf2sfile_def split:option.splits)

    apply (case_tac sf, simp)

    done

  show ?thesis using grant f_in f_in' psfs psfs' psfs_eq sec

    apply (simp add:Cons split:option.splits)

    by (case_tac a, simp)

qed

lemma enrich_search_check':

  assumes grant: "search_check s (up, rp, tp) f"

  and cf2sf: "\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile s' f = cf2sfile s f"

  and vd: "valid s" and vd': "valid s'" and f_in: "is_dir s f"  and f_in': "is_dir s' f"

  and sec: "sectxt_of_obj s' (O_dir f) = sectxt_of_obj s (O_dir f)"

  shows "search_check s' (up, rp, tp) f"

proof (cases f)

  case Nil

  have "sectxt_of_obj s' (O_dir []) = sectxt_of_obj s (O_dir [])"

    using cf2sf 

    apply (erule_tac x = "[]" in allE)

    by (auto simp:cf2sfile_def root_sec_remains vd vd')

  thus ?thesis using grant Nil 

    by auto

next

  case (Cons n pf)

  from vd f_in obtain sf where sf: "cf2sfile s f = Some sf"

    apply (drule_tac is_dir_in_current, drule_tac current_file_has_sfile, simp)

    apply (erule exE, simp)

    done

  then obtain psfs where psfs: "get_parentfs_ctxts s pf = Some psfs" using Cons

    by (auto simp:cf2sfile_def split:option.splits if_splits)

  from sf cf2sf f_in have sf': "cf2sfile s' f = Some sf" by (auto dest:is_dir_in_current)

  then obtain psfs' where psfs': "get_parentfs_ctxts s' pf = Some psfs'"using Cons

    by (auto simp:cf2sfile_def split:option.splits if_splits)

  with sf sf' psfs have psfs_eq: "set psfs' = set psfs" using Cons f_in f_in'

    apply (drule_tac is_dir_not_file)

    apply (drule is_dir_not_file)    

    apply (simp add:cf2sfile_def split:option.splits)

    apply (case_tac sf, simp)

    done

  show ?thesis using grant f_in f_in' psfs psfs' psfs_eq sec

    apply (drule_tac is_dir_not_file)

    apply (drule_tac is_dir_not_file)

    apply (simp add:Cons split:option.splits)

    by (case_tac a, simp)

qed

lemma proc_filefd_has_sfd: "\<lbrakk>fd \<in> proc_file_fds s p; valid s\<rbrakk> \<Longrightarrow> \<exists> sfd. cfd2sfd s p fd = Some sfd"

apply (simp add:proc_file_fds_def)

apply (auto dest: current_filefd_has_sfd)

done

lemma enrich_inherit_fds_check:

  assumes grant: "inherit_fds_check s (up, nr, nt) p fds"  and vd: "valid s"

  and cfd2sfd: "\<forall> p fd. fd \<in> proc_file_fds s p\<longrightarrow> cfd2sfd s' p fd = cfd2sfd s p fd"

  and fd_in: "fds \<subseteq> proc_file_fds s p" and fd_in': "fds \<subseteq> proc_file_fds s' p"

  shows "inherit_fds_check s' (up, nr, nt) p fds"

proof-

  have "\<And> fd. fd \<in> fds \<Longrightarrow> sectxt_of_obj s' (O_fd p fd) = sectxt_of_obj s (O_fd p fd)"

  proof-

    fix fd

    assume fd_in_fds: "fd \<in> fds"

    hence fd_in_cfds: "fd \<in> proc_file_fds s p" 

      and fd_in_cfds': "fd \<in> proc_file_fds s' p" 

      using fd_in fd_in' by auto

    with cfd2sfd

    have cfd_eq: "cfd2sfd s' p fd = cfd2sfd s p fd" by auto

    from fd_in_cfds obtain f where ffd: "file_of_proc_fd s p fd = Some f"

      by (auto simp:proc_file_fds_def)

    moreover have "flags_of_proc_fd s p fd \<noteq> None"

      using ffd vd by (auto dest:current_filefd_has_flags)

    moreover have "sectxt_of_obj s (O_fd p fd) \<noteq> None"

      using fd_in_cfds vd

      apply (rule_tac notI)

      by (auto dest!:current_has_sec' file_fds_subset_pfds[where p = p] intro:vd)

    moreover have "cf2sfile s f \<noteq> None"

      apply (rule notI)

      apply (drule current_file_has_sfile')

      using ffd

      by (auto simp:vd is_file_in_current dest:file_of_pfd_is_file)

    ultimately show "sectxt_of_obj s' (O_fd p fd) = sectxt_of_obj s (O_fd p fd)"

      using cfd_eq

      by (auto simp:cfd2sfd_def split:option.splits)

  qed

  hence "sectxts_of_fds s' p fds = sectxts_of_fds s p fds"

    by (simp add:sectxts_of_fds_def)

  thus ?thesis using grant

    by (simp add:inherit_fds_check_def)

qed

lemma enrich_inherit_fds_check_dup:

  assumes grant: "inherit_fds_check s (up, nr, nt) p fds"  and vd: "valid s"

  and cfd2sfd: "\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd s' p' fd = cfd2sfd s p fd"

  and fd_in: "fds' \<subseteq> fds \<inter> proc_file_fds s p" 

  shows "inherit_fds_check s' (up, nr, nt) p' fds'"

proof- 

  have "sectxts_of_fds s' p' fds' \<subseteq> sectxts_of_fds s p fds"

  proof-

    have "\<And> fd sfd. \<lbrakk>fd \<in> fds'; sectxt_of_obj s' (O_fd p' fd) = Some sfd\<rbrakk> 

                     \<Longrightarrow> \<exists> fd \<in> fds. sectxt_of_obj s (O_fd p fd) = Some sfd"

    proof-

      fix fd sfd

      assume fd_in_fds': "fd \<in> fds'"

        and sec: "sectxt_of_obj s' (O_fd p' fd) = Some sfd"

      from fd_in_fds' fd_in

      have fd_in_fds: "fd \<in> fds" and fd_in_cfds: "fd \<in> proc_file_fds s p" 

        by auto

      from fd_in_cfds obtain f where ffd: "file_of_proc_fd s p fd = Some f"

        by (auto simp:proc_file_fds_def)

      moreover have "flags_of_proc_fd s p fd \<noteq> None"

        using ffd vd by (auto dest:current_filefd_has_flags)

      moreover have "cf2sfile s f \<noteq> None"

        apply (rule notI)

        apply (drule current_file_has_sfile')

        using ffd

        by (auto simp:vd is_file_in_current dest:file_of_pfd_is_file)

      moreover have "sectxt_of_obj s (O_fd p fd) \<noteq> None"

        using fd_in_cfds vd

        apply (rule_tac notI)

        by (auto dest!:current_has_sec' file_fds_subset_pfds[where p = p] intro:vd)

      ultimately 

      have "sectxt_of_obj s (O_fd p fd) = Some sfd"

        using fd_in_cfds cfd2sfd sec

        apply (erule_tac x = fd in allE)

        apply (auto simp:cfd2sfd_def split:option.splits)

        done

      thus "\<exists> fd \<in> fds. sectxt_of_obj s (O_fd p fd) = Some sfd"

        using fd_in_fds

        by (rule_tac x = fd in bexI, auto)

    qed

    thus ?thesis by (auto simp:sectxts_of_fds_def)

  qed

  thus ?thesis using grant

    by (auto simp:inherit_fds_check_def inherit_fds_check_ctxt_def)

qed

lemma enrich_valid_intro_cons:

  assumes vs': "valid s'" and vd': "valid (e # s)"

    and alive: "\<forall> obj. alive s obj \<longrightarrow> alive s' obj"

    and alive': "\<forall> obj. enrich_not_alive s obj' obj \<longrightarrow> enrich_not_alive s' obj' obj"

    and hungs: "files_hung_by_del s' = files_hung_by_del s"

    and cp2sp: "\<forall> p. p \<in> current_procs s \<longrightarrow> cp2sproc s' p = cp2sproc s p"

    and cf2sf: "\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile s' f = cf2sfile s f"

    and cq2sq: "\<forall> q. q \<in> current_msgqs s \<longrightarrow> cq2smsgq s' q = cq2smsgq s q"

    and ffd_remain: "\<forall> p fd f. file_of_proc_fd s p fd = Some f \<longrightarrow> file_of_proc_fd s' p fd = Some f"

    and fflags_remain: "\<forall> p fd flags. flags_of_proc_fd s p fd = Some flags \<longrightarrow> flags_of_proc_fd s' p fd = Some flags"

    and sms_remain: "\<forall> q. q \<in> current_msgqs s \<longrightarrow> msgs_of_queue s' q = msgs_of_queue s q"

   (* and empty_remain: "\<forall> f. dir_is_empty s f \<longrightarrow> dir_is_empty s' f" *)

    and cfd2sfd: "\<forall> p fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd s' p fd = cfd2sfd s p fd"

    and nodel: "no_del_event (e # s)"

    and notin_cur: "notin_cur (e # s) obj'"

  shows "valid (e # s')"

proof-

  from vd' have os: "os_grant s e" and grant: "grant s e" and vd: "valid s"

    by (auto dest:vt_grant_os vt_grant vd_cons)

  show ?thesis

  proof (cases e)

    case (Execve p f fds)

    have p_in: "p \<in> current_procs s'" using os alive

      apply (erule_tac x = "O_proc p" in allE)

      by (auto simp:Execve)

    have f_in: "is_file s' f" using os alive

      apply (erule_tac x = "O_file f" in allE)

      by (auto simp:Execve)

    have fd_in: "fds \<subseteq> proc_file_fds s' p" using os alive ffd_remain

      by (auto simp:Execve proc_file_fds_def)

    have "os_grant s' e" using p_in f_in fd_in by (simp add:Execve)

    moreover have "grant s' e"

    proof-

      from grant obtain up rp tp uf rf tf 

        where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"

        and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" 

        by (simp add:Execve split:option.splits, blast)

      with grant obtain pu nr nt where p3: "npctxt_execve (up, rp, tp) (uf, rf, tf) = Some (pu, nr, nt)"

        by (simp add:Execve split:option.splits del:npctxt_execve.simps, blast)

      from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"

        using os cp2sp

        apply (erule_tac x = p in allE)

        by (auto simp:Execve co2sobj.simps cp2sproc_def split:option.splits)

      from os have f_in': "is_file s f" by (simp add:Execve)

      from vd os have "\<exists> sf. cf2sfile s f = Some sf"

        by (auto dest!:is_file_in_current current_file_has_sfile simp:Execve)

      hence p2': "sectxt_of_obj s' (O_file f) = Some (uf, rf, tf)" using f_in f_in' p2 cf2sf

        apply (erule_tac x = f in allE)

        apply (auto dest:is_file_in_current simp:cf2sfile_def split:option.splits)

        apply (case_tac f, simp)

        apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)

        done

      have "inherit_fds_check s' (pu, nr, nt) p fds"

      proof-

        have "fds \<subseteq> proc_file_fds s' p" using os ffd_remain Execve

          by (auto simp:proc_file_fds_def)

        thus ?thesis using Execve grant vd cfd2sfd p1 p2 p3 os

          apply (rule_tac s = s in enrich_inherit_fds_check)

          by (simp_all split:option.splits)

      qed

      moreover have "search_check s' (pu, rp, tp) f"

        using p1 p2 p2' vd cf2sf f_in' grant Execve p3 f_in

        apply (rule_tac s = s in enrich_search_check)

        by (simp_all split:option.splits)

      ultimately show ?thesis using p1' p2' p3

        apply (simp add:Execve split:option.splits) 

        using grant Execve p1 p2

        by (simp add:Execve grant p1 p2)

    qed

    ultimately show ?thesis using vs'

      by (erule_tac valid.intros(2), simp+)

  next

    case (Clone p p' fds)

    have p_in: "p \<in> current_procs s'" using os alive

      apply (erule_tac x = "O_proc p" in allE)

      by (auto simp:Clone)

    have p'_not_in: "p' \<notin> current_procs s'" using  alive' notin_cur os Clone

      apply (erule_tac x = "I_proc p'" in allE)

      apply (auto simp del:nums_of_recvmsg.simps)

      done

    have fd_in: "fds \<subseteq> proc_file_fds s' p" using os alive ffd_remain

      by (auto simp:Clone proc_file_fds_def)

    have "os_grant s' e" using p_in p'_not_in fd_in by (simp add:Clone)

    moreover have "grant s' e" 

    proof-

      from grant obtain up rp tp 

        where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"

        apply (simp add:Clone split:option.splits)

        by (case_tac a, auto)

      from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"

        using os cp2sp

        apply (erule_tac x = p in allE)

        by (auto simp:Clone co2sobj.simps cp2sproc_def split:option.splits)

      have p2: "inherit_fds_check s' (up, rp, tp) p fds"

      proof-

        have "fds \<subseteq> proc_file_fds s' p" using os ffd_remain Clone

          by (auto simp:proc_file_fds_def)

        thus ?thesis using Clone grant vd cfd2sfd p1 os

          apply (rule_tac s = s in enrich_inherit_fds_check)

          by (simp_all split:option.splits)

      qed

      show ?thesis using p1 p2 p1' grant

        by (simp add:Clone)

    qed

    ultimately show ?thesis using vs'

      by (erule_tac valid.intros(2), simp+)

  next

    case (Kill p p')

    have p_in: "p \<in> current_procs s'" using os alive

      apply (erule_tac x = "O_proc p" in allE)

      by (auto simp:Kill)

    have p'_in: "p' \<in> current_procs s'" using os alive

      apply (erule_tac x = "O_proc p'" in allE)

      by (auto simp:Kill)

    have "os_grant s' e" using p_in p'_in by (simp add:Kill)

    moreover have "grant s' e" 

    proof-

      from grant obtain up rp tp up' rp' tp'

        where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"

        and p'1: "sectxt_of_obj s (O_proc p') = Some (up', rp', tp')"

        apply (simp add:Kill split:option.splits)

        by (case_tac a, case_tac aa, blast)

      from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"

        using os cp2sp

        apply (erule_tac x = p in allE)

        by (auto simp:Kill co2sobj.simps cp2sproc_def split:option.splits)

      from p'1 have p'1': "sectxt_of_obj s' (O_proc p') = Some (up', rp', tp')"

        using os cp2sp

        apply (erule_tac x = p' in allE)

        by (auto simp:Kill co2sobj.simps cp2sproc_def split:option.splits)

      show ?thesis using p1 p'1 p1' p'1' grant

        by (simp add:Kill)

    qed

    ultimately show ?thesis using vs'

      by (erule_tac valid.intros(2), simp+)

  next

    case (Ptrace p p')

    have p_in: "p \<in> current_procs s'" using os alive

      apply (erule_tac x = "O_proc p" in allE)

      by (auto simp:Ptrace)

    have p'_in: "p' \<in> current_procs s'" using os alive

      apply (erule_tac x = "O_proc p'" in allE)

      by (auto simp:Ptrace)

    have "os_grant s' e" using p_in p'_in by (simp add:Ptrace)

    moreover have "grant s' e" 

    proof-

      from grant obtain up rp tp up' rp' tp'